CLAIMS: 

1 . A method for managing traffic in a communications network comprising acts of: 

(a) providing, in a network device, a cache containing at least predefined 
characteristics associated with packets and actions paired with selected ones of said 

5 predefined characteristics; 

(b) receiving at least one packet in said network device; 

(c) selecting from said received packet characteristics similar to the at least 
predefined characteristics; 

(d) correlating the characteristics selected from said received packet with the 
10 predefined characteristics; and 

(e) using results from the correlation to process the received packet. 

2. The method of claim 1 wherein the process includes enforcing the paired action 
against the received packet if the characteristics of said received packet matches the at 
least predefined characteristics. 

15 3. The method of claim 1 or claim 2 wherein the at least predefined characteristics 
include Internet Protocol (IP) Destination Address (DA), IP Source Address (SA), 
Transmission Control Protocol (TCP) Destination Port (DP) and TCP Source Port (SP). 

4. The method of claim 1 wherein the correlating act includes comparing. 

5. A method comprising the acts of: 

20 providing in a memory a mapping of predefined characteristics associated with 
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packets and actions to be performed; 
receiving packets to be classified; 

correlating selected characteristics of received packets with the predefined 
characteristics; and 
5 performing stored actions on said received packets, if the selected 

characteristics match the predefined characteristics. 

6. The method of claim 5 wherein the correlating act includes comparing. 

7. The method of claim 5 wherein the predefined characteristics include Source 
Address (SA), Destination Address (DA), Source Port (SP) and Destination Port (DP). 

10 8. The method of claim 5 wherein the received packets include data packets. 

9. The method of claim 5 wherein the stored action associated with predefined 
characteristics are updated only from a first packet of a group of packets. 

10. The method of claim 9 wherein the stored actions are being performed on all 
packets following the first packet of the group of packets. 

15 1 1 . A system including 
a processor; and 

a cache operatively coupled to said processor, said cache storing a mapping 
between predefined characteristics of packets and actions wherein said processor 
executes a first program that causes said processor to correlate characteristics of 
20 selected packets with the predefined characteristics and enforcing on said selected 
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packets actions associated with predefined characteristics if characteristics from the 
selected packets match the predefined characteristics. 

12. The system of claim 1 1 wherein the predefined characteristics include Source 
Address (SA), Destination Address (DA), Source Port (SP) and Destination Port (DP). 

5 13. The system of claim 1 1 wherein the processor includes a network processor. 

14. The system of claim 1 1 further including a memory operatively coupled to said 
processor and storing therein a data structure for a full packet search wherein said 
processor executes a second program that causes said processor to access the data 
structure and imposing on said selected packet an action stored in said data structure if 

10 a mismatch occurs between the predefined characteristics and the characteristics from 
the selected packets. 

15. The system of claims 11 or 14 wherein the selected packet includes received 
packets. 

16. The system of claim 14 wherein the second program includes a full match 
15 algorithm. 

17. The system of claim 14 wherein the second program includes a Longest Prefix 
Match algorithm. 
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18. The system of claim 14 wherein the second program includes a Software 
Managed Tree algorithm. 

19. The system of claim 14 wherein the memory is internal to the processor. 

20. The system of claim 14 wherein the memory is external to the processor. 

5 21 . The system of claim 1 4 wherein the data structure includes a Direct Table and 
Patricia Tree. 

22. A system including 

a memory that stores a mapping between predefined characteristics of packets 
and actions to be performed for a subset of the set of all characteristic values; and 
10 a controller that correlates characteristics in a received packet with the 

predefined characteristics and performing the actions on said received packet if the 
characteristics match the predefined characteristics. 

23. A program product including a medium on which a computer program is 
recorded, said program including instructions that correlate characteristics of a received 

15 packet with characteristics in a table, said table containing a subset of all possible 
characteristic values; and 

instructions to enforce an action stored in said table on the received packet if the 
characteristics of the received packet and the characteristics in the table match. 
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24. The program product of claim 23 further including instructions to generate the 
table containing the characteristics and associated actions. 

25. The program product of claim 24 further still including instructions to maintain the 
table. 

5 26. The program product of claim 25 wherein the instructions to maintain further 
includes instruction to delete aged entries and insert new entries. 

27. The method of claim 1 wherein the at least one packet received in (b) satisfies a 
Frequent Flyer criteria of being one packet within a short burst of packets belonging to 
the same session. 

10 28. The system of claim 22 further including aging mechanism operatively coupled to 
the memory, said aging mechanism periodically deleting old entries from said memory. 

29. The system of claim 28 wherein old entries are being deleted based upon a 
predefined criteria. 

30. The system of claim 29 wherein the predefined criteria includes deleting least 
15 recently used entry when said memory is full and a new entry needs to be added. 

31 . A method of classifying packets in a communications network comprising acts of: 

(a) receiving packets in a network device; 

(b) determining data packets present in received packets; 
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(c) providing a cache in which predefined characteristics of packets and 
actions associated with selected ones of the predefined characteristics are stored; 

for each data packet so determined, correlating selected characteristics of said 
each data packet with the predefined characteristics in said cache; and 
5 for each data packet with selected characteristics matching one of the 

predefined characteristics imposing on said each data packet the action associated with 
said one of the predefined characteristics. 

32. The method of claim 31 wherein the packets include TCP/IP packets. 

33. The method of claim 32 wherein the determining act further includes the act of 
10 examining control bits in the TCP header; 

if selected ones of said control bits are set to a first state, examining length field 
in the IP header to determine its value; 

multiplying a value in the data offset field in the TCP header by 4; and 
subtracting the result of the multiplication from the value in the length field. 

15 34. The method of claim 33 wherein the first state includes logical "0". 

35. The method of claim 33 wherein the selected ones of said control bits include 
SYN, FIN and RST. 
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